Ruby For Pentesters - The Dark Side I: Ragweed

Last summer I was given the task of porting a Win32 Ruby scriptable debugger to OSX… a task I accomplished with some consternation.

Over the last year of working here at Matasano, I’ve had some time to refine the code enough for release. I’ve cleaned up a bunch of the code resulting from my inexperience with Ruby, implemented a couple features and fixed several bugs. Meanwhile, Chris Rohlf began a Linux port and its beginnings are included in the gem. And yes, Ragweed is now available as a gem through github. (sudo gem install tduehr-ragweed for the impatient with github as a gem source)

Why a scriptable debugger?

When reversing, the usual debugging tools for developers aren’t as useful. They’re built for stepping interactively through programs you have source code for. They don’t generally have methods to get data out.

Reversing also requires being able to do mean and nasty things to the running process. When tracing calls, you want to watch how they interact. The last thing you want to do is anything manual. Automation is a requirement.

Also helpful is the ability to automate information gathering tasks, or the ability to dynamically add, remove or change breakpoints. These features are why scriptable debuggers have been created: To play with black boxes in a more dynamic and seedier manner.

What’s available already?

There are already scriptable debuggers out there.  The most notable are PaiMei/PyDbg, Immunity Debugger and IDA.

PaiMei is written in Python, bills itself as “a reverse engineer’s swiss army knife” and uses the Python ctypes library for low level win32 calls.  

Immunity Debugger is a GUI debuggger for win32 that uses Python for its scripting functionality.  

IDA Pro is largely a win32 disassembler, but it is scriptable, again in Python, and includes a debugging module.

Before I get run off by a screaming mob with pitchforks, flightless birds, members of the family bovidae, etc., I will also mention GDB which has a library in development (libgdb) and can be scripted through macros.

With the exception of GDB which runs on most platforms and has its own macro language, these all share two common problems: Win32 and Python. Matasano is a Ruby shop. We like Ruby. It is good to us. We also wanted a tool for non-Win32 applications. But mostly, we just wanted something in Ruby.

Enter Ragweed

I’m going to stick to the OSX side of Ragweed for this article since I’m most familiar with it and there is still work to be done to unify the (currently) three debugging APIs —- Win32, Linux, and OSX —- inside Ragweed.

Under the hood, Ragweed (on OSX) uses Ruby/DL to perform the various low level system calls necessary to create a debugger. (More about that in my post from last year). These calls are abstracted somewhat to provide a smoother, more Ruby-like interface.

There are two caveats for Ragweed in OSX:

• Due to the changes in Ruby 1.9 to DL, it is currently incompatible with 1.9.

• Also, under OSX, Ragweed wants to run as root due to restrictions on task_for_pid.

A quick example (this we can do in IRB):

# debugging ftp using default signal handlers, printing registers every stop and logging calls to _lpwd

  require ‘ragweed’
  class DebugFtp < Debuggerosx

  # print the registers every time the process stops

    def on_stop(signal)

      puts "Stopped with signal #{signal}"

      self.threads.each {|t| self.get_registers(t).dump}

    end

  end

  # no process lookup by name yet

  d = DebugFtp.new(pid) # where pid is the id of ftp for this example

  # set breakpoint for lpwd

  d.breakpoint_set(0x420f,‘lpwd’, (bpl = lambda do | t, r, s | puts "#{ s.breakpoints[r.eip].first.function } hit in thread #{ t }\n"; end))

  d.install_breakpoints

  d.continue

  d.loop #loop until child exits

  # now go do stuff in in your other terminal window running ftp

That’s it. We just override the signal handlers for the signals we want to know about (or not), attach to a running process, set and install breakpoints, and it’s off to the traces. A simple hit tracer is only a CSV file and read loop away from this.

Want info on a region of memory?

d.region_info(0x0,:basic).dump

What about thread_info?

d.threadinfo(threadid).dump

Break stuff by playing with registers?

regs = d.get_registers(thread_id) regs.eip = 0x420f d.set_registers(thread_id, regs)

Grope through the child’s memory?

Ragweed::Wraposx::vm_read(d.task, address, size) #returns a string of child's memory

There you have it. It’s not pretty but it’s only begun.

Comments

[Stomach fat exercises]

Great information thanks want more information on..

Exercise to flatten stomach... can you post...

[asdasd]

Juicy clothes
Buy full line Juicy couture products from our site at a low price to make yourself a fashionista! Dress juicy couture clothing, holding juicy couture
Shop prom dresses, formal dresses, prom shoes, 2010 designer prom gowns at dres4sale.
for cocktail dresses, dresses for prom, homecoming dresses, and evening dresses. Cheap prom dresses or couture designer evening gowns for your next formal.
evening dresses
Evening Dresses. Women's Formal & Special Occasion Dresses ... Welcome to Cheap Evening Dresses for Sale! ... Buy Cheap Evening Dresses Sales & Accessories
prom dresses

[Guns]

Yes.. whenever i use these type of script, justconfused... but managed...

Paloma Water Heater

[james lee]

This is so good to use. I think this is definitely the future. I think this needs to be pushed more in technology.
qui tam lawyers los angeles

[logo design]

There are two caveats for Ragweed in OSX:

*

Due to the changes in Ruby 1.9 to DL, it is currently incompatible with 1.9.
*

Also, under OSX, Ragweed wants to run as root due to restrictions on task_for_pid.

Logo Design | Logo Designs | Business Logo | Website Design

[Saguntha]

Wonderful information. I will go to share this to my friends...

Email Database

[p90x]

P90x .It really is not expensive if you factor in the cost

of a gym membership,P90x workout . The cost for P90X is

about three months of a paid gym membership but you get to

keep the program foreverP90x . You can try many of the

online sites, but it will be the same as buying from the

company or a Beachbody Coach. Make sure you are getting

original DVD's. People are selling copies all over. The

problem is how long will they last, P90x workout ,and you

truly need the exercise and nutrition guide to even follow

the program. You can go to any site

http://www.p90xmall.com/ or you can go to and click on

products. P90x dvd You can order directly from the

site,P90x dvd.

[Sivam]

I like this post very much. I will go to share this in my twitter page...

Products Review and Price.

[jhon botha]

nice post.
web hosting
hosting services
webhosting
unlimited web hosting
dedicated server hosting

[frg]

i like it.
Seo Services
Seo expert
search marketing
pay per click
web designer

[gyhh]

great blog.
cheapest kamagra
online kamagra
kamagra uk
buy kamagra online
kamagra pills
Buy cheap kamagra

[Lp]

Hey, I am checking this site from my Blackberry and it looks kinda funky. Thought you’d want to know. It’s a great post though, didn’t mess that up

Portable Air Conditioning Unit
Business week MBA
jazz music download
Email Database
double oven electric range
microwave rice cooker
Hot News and Events
Products Review and Price

[tiffany1837jewelry]

925tiffanyco
925tiffanyblog
925jewelryblog
925royaljewelry
love925silver
discountjewelry

[SK]

Hey, I am checking this site from my Blackberry and it looks kinda funky. Thought you’d want to know. It’s a great post though, didn’t mess that up

Small Corner Computer Desk
Cheap Life Assurance Quote
Dolce and Gabbana Sunglasses
Female Hair Transplant
Hair Loss Solutions
Disney Minnie Mouse

[harry123]

Provide high quality silver Tiffany jewellery including necklaces,rings and other style jewelry at wholesale prices.Pick your dreaming
Tiffany jewellery
Tiffany co
Tiffany
Tiffany Stores is the best online United Kingdom jewelry stores where you can buy the cheapest Tiffany & Co silver jewelry.
Our huge selection of Tiffany
Tiffany & Co Rings
Tiffany & Co Earrings
Tiffany & Co Bracelets
Buy cartier ring, cartier love on abcartier.com. We also provide cartier bracelet, cartier jewelry and so on. Now come on and get what you want.
Cartier Jewelry
Cartier jewellery

[rosetta]

The article written by your very good, I like it very much. I will keep your new article.
rosetta stone spanish,
rosetta stone,
rosetta stone language.

[prom123]

prom dresses 2010
prom dresses and gowns
affordable prom dresses
prom dresses on sale
plus size prom dress
cheap prom dresses under 100
prom dresses under 100

[DWI attorneys]

i need to ask one thing whenever i put the word end in the coding they said error found why is it so?

[internet via satellite]

i came across this language but didn't understand much, i hope this time i will get it through and make one IRB. Thanks

[internet via satellite]

I came across this language but didn't understand much, i hope this time i will get it through and make one IRB. Thanks internet via satellite

[uk essay writing]

This is my first time i visit here. I provide web hosting in pakistan & also i write essays for custom essay writing I found so many interesting stuff in your blog especially its discussion. i also have a website at: business card printing
and i also give news updates pakistan I
guess I am not the only one having all the enjoyment here!
keep up the good work.
Many Thanks!

web hosting pakistan | domain hosting pakistan | web hosting in pakistan | download free software | news updates pakistan | news updates pakistan | custom essay writing | apa paper writing | business card printing | panaflex printing | stationery printing | seo training in karachi | seo services | seo expert | printing services pakistan | embroidery punching | embroidery digitizers | custom digitizing | custom essay writing uk | english to urdu translation

[rolex watches]

People usually say :"Seeing is believing." GHD Each attempt has a corresponding gain, in part or obvious, or vague. At least we have the kind of satisfaction After I bought this watch ,in a sense,it means a great deal to me. net a porter thank you!it is very useful tools to protect our time.If you never pay attention to yourself ,please grasp this chance.a few days ago,I bought a Rolex watches.IT's very good to use.So i want to write an article about watches to share with everyone on So as to more and more people to konw it. UGG brand is relatively common, in addition to the Rolex ping g15even see watch on the movement and you don't know.
Rolex watches

[louis vuitton]

You'll be just as cool as the girls walking through the halls of your local high schools, only difference is that most of them aren't carrying authentic vuitton replica . When you want something a little different but full of style, louis vuitton replica and genuine good taste in style, carry louis replica .

[vivienne westwood]

DDo you have heard ed hardy ? Let's me introduce it to you,it contain ed hardy t shirts , ed hardy bags and ed hardy handbags and so on.
Also,Are your look at vivienne westwood jewellery,vivienne westwood necklace, its brand is vivienne westwood.It includes vivienne westwood earrings,vivienne westwood necklace,vivienne westwood bags and vivienne westwood wallet, vivienne westwood purse,vivienne westwood handbags and vivienne westwood cufflinks,vivienne westwood brooches and so on. The brand cheap vivienne westwood is more and more popular now. Now days,juicy couture became more and more popular,it includes juicy couture flip flops,juicy couture tracksuits,juicy couture watches,Particularly in summer.

[lida daidaihua]

ED Hardy jeans and shirts are so stylish and flexible that it can be literally worn by almost everyone. The hardy shirts shirts and jeans are made of lightweight materials and every shirt has that unique and expressive print that captures the vintage look. These are so carefully conceptualized by the greatest tattoo artist of his time, hardy shirts . That simply confirms that the ideas and concepts embedded on the hardy shirt Clothing are rooted to the natural flair of its maker and founder for unique and meticulous designs.

The chanel watches vintage online collection is not demarcated as a separate collection as per catalogues since Chanel bags collection is only meant to give a broader choice and does not feature any new designs. It is meant for increasing the ease with which people can browse past Chanel bag and make it a better shopping experience. Chanel Wallet also allows customers to ask for their favored designs rather than the ones available in season.